Executive brief
The Linux kernel's VMware graphics driver (vmwgfx) contains an integer overflow vulnerability in shader creation validation. When a user provides a crafted shader offset value near the maximum 64-bit integer, unsigned arithmetic wraps to a small value that bypasses buffer boundary checks, potentially allowing unauthorized memory access or graphics device compromise.
Technical details
The vulnerability exists in vmw_shader_define() in the drm/vmwgfx driver, which validates a user-supplied shader window offset and size against the backing buffer size using the check: (u64)buffer->tbo.base.size < (u64)size + (u64)offset. When the offset (a __u64 user-controlled value) is crafted near U64_MAX, the unsigned addition of size and offset wraps around, producing a tiny value that passes the validation check. The unbounded offset is then stored in guest_memory_offset and forwarded to host SVGA shader-create commands. The fix replaces the vulnerable comparison with check_add_overflow() to detect wraparound and properly validate the computed endpoint against the buffer size. This is a local vulnerability requiring driver interface access.
Affected products
- Linux Linux kernel multiple versions (fix backported across stable branches 4.x through 7.x)
Timeline
- 2026-09-04: disclosed: Published in NVD
- 2026-05-05: patched: Patch committed upstream by Zack Rusin
- 2026-08-09: patched: Backported to stable kernel versions